Archive
16 December 2019
Vulnerabilities first published on this day (UTC), newest first.
48 results · Feed
-
High 8.1
The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_ha…
-
Medium 5.3
Users able to query database metadata in Apache Superset
In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query.
-
Medium 5.3
Users can view database names in Apache Superset
In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab
-
Unscored —
There is an information leakage vulnerability on some Huawei products(AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200…
-
Unscored —
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue…
-
Unscored —
A privilege escalation vulnerability in the Trend Micro Deep Security as a Service Quick Setup cloud formation template…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability exists in the web UI of SolarWinds Serv-U FTP Server 15.1.7.
-
Unscored —
A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7.
-
Low 2.6
Heap buffer overflow in `UnsortedSegmentSum` in TensorFlow
In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in …
-
Unscored —
The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDes…
-
Unscored —
The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDe…
-
Unscored —
An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an…
-
Unscored —
The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDes…
-
High 7.6
Settings for the Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3 contain a configuration vulnerability. The BIOS…
-
Medium 5.8
In RubyGem excon, interrupted Persistent Connections May Leak Response Data
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the …
-
High 7.8
Yarn Improper link resolution before file access (Link Following)
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
-
Unscored —
In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the sof…
-
High 8.1
In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between …
-
High 8.6
Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.
-
Unscored —
In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages …
-
Unscored —
Improper permissions in the Intel(R) Dynamic Platform and Thermal Framework v8.3.10208.5643 and before may allow an aut…
-
Unscored —
Insufficient memory protection in the Linux Administrative Tools for Intel(R) Network Adapters before version 24.3 may …
-
Unscored —
Insufficient memory protection for Intel(R) Ethernet I218 Adapter driver for Windows* 10 before version 24.1 may allow …
-
Unscored —
Improper conditions check in the Linux kernel driver for the Intel(R) FPGA SDK for OpenCL(TM) Pro Edition before versio…
-
Unscored —CVE-2019-11157 Public exploit
Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially e…
-
Unscored —
Improper permissions in the executable for Intel(R) RST before version 17.7.0.1006 may allow an authenticated user to p…
-
Unscored —
Out of bounds write in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of pri…
-
Unscored —
Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privil…
-
Unscored —
Improper input validation in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation …
-
Unscored —
Improper access control in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalatio…
-
Unscored —
Improper buffer restrictions in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable esca…
-
Unscored —
Improper conditions check in multiple Intel® Processors may allow an authenticated user to potentially enable partial e…
-
Unscored —
Improper permissions in the installer for the Intel(R) SCS Platform Discovery Utility, all versions, may allow an authe…
-
Unscored —
Improper permissions in the installer for the License Server software for Intel® Quartus® Prime Pro Edition before vers…
-
Unscored —
Null pointer dereference in the FPGA kernel driver for Intel(R) Quartus(R) Prime Pro Edition before version 19.3 may al…
-
Unscored —
Unquoted service path in Control Center-I version 2.1.0.0 and earlier may allow an authenticated user to potentially en…
-
Unscored —CVE-2019-19743 Public exploit
On D-Link DIR-615 devices, a normal user is able to create a root(admin) user from the D-Link portal.
-
Unscored —
Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary lo…
-
Unscored —
Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure. The encrypted ClickShare Button fi…
-
Unscored —
Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'dongle_bridge' progr…